Make return-to-websession more TR-03112 conforming

The algorithm in sec. 3.4.5 states, that if the refresh address conforms to the
Same-Origin-Policy (SOP), then no GET on the adress is performed. In case The refresh is not SOP,
then it must be followed and only stopped, when the SOP endpoint returns a redirect which in turn is
not retrieved by the client. This algorithm is sick ...
Fix Bug #230: Provide full MessageDialog support for Android

All methods specified by the MessageDialog-Interface are now implemented.
The Android implementation return a dummy OK result immediately. The real
result is available in the onActivityResult callback of the calling Activity.
Throw HTTPException when HTTP result in TCTokenGrabber is an error (fixes #235)
Disable redirect checks when using object activation (fixes #233)
Add logging of HTTP messages in TCTokenGrabber (fixes #234)
Remove session id strength check (fixes #236)

The alphabet of session IDs is not restricted by the specification, so a check for the bits raising
the entropy is not doable. This fix removes the check altogether.
Remove code to wait for eID service to finish when using object tag
Restrict optional CHAT instead of producing an error if more is requested than is allowed